SYMBOLCOMMON_NAMEaka. SYNONYMS
win.trochilus_rat (Back to overview)

Trochilus RAT

Actor(s): APT31, GALLIUM, Stone Panda

VTCollection    

Trochilus is a C++ written RAT, which is available on GitHub.
GitHub Repo:
- https://github.com/m0n0ph1/malware-1/tree/master/Trochilus
- https://github.com/5loyd/trochilus

References
2022-09-15SymantecThreat Hunter Team
Webworm: Espionage Attackers Testing and Using Older Modified RATs
9002 RAT Ghost RAT Trochilus RAT
2022-09-13SymantecThreat Hunter Team
New Wave of Espionage Activity Targets Asian Governments
MimiKatz PlugX Quasar RAT ShadowPad Trochilus RAT
2022-04-27TrendmicroDaniel Lunghi, Jaromír Hořejší
Operation Gambling Puppet
reptile oRAT AsyncRAT Cobalt Strike DCRat Ghost RAT PlugX Quasar RAT Trochilus RAT Earth Berberoka
2021-01-15SwisscomMarkus Neis
Cracking a Soft Cell is Harder Than You Think
Ghost RAT MimiKatz PlugX Poison Ivy Trochilus RAT
2020-06-24Counter Threat Unit ResearchTeam
BRONZE VINEWOOD Targets Supply Chains
MimiKatz Trochilus RAT APT31
2020-06-03Trend MicroDaniel Lunghi
How to perform long term monitoring of careless threat actors
BBSRAT HyperBro Trochilus RAT
2020-02-18Trend MicroCedric Pernet, Daniel Lunghi, Jamz Yaneza, Kenney Lu
Uncovering DRBControl: Inside the Cyberespionage Campaign Targeting Gambling Operations
Cobalt Strike HyperBro PlugX Trochilus RAT
2020-01-01SecureworksSecureWorks
BRONZE VINEWOOD
MimiKatz Trochilus RAT APT31
2019-02-06Recorded FutureInsikt Group, Rapid7
APT10 Targeted Norwegian MSP and US Companies in Sustained Campaign
Trochilus RAT APT31 HURRICANE PANDA
2017-11-03Github (5loyd)5loyd
Trochilus
Trochilus RAT
2017-04-03JPCERT/CCShusei Tomonaga
RedLeaves - Malware Based on Open Source RAT
PlugX RedLeaves Trochilus RAT
2017-04-01PricewaterhouseCoopersPricewaterhouseCoopers
Operation Cloud Hopper: Technical Annex
ChChes PlugX Quasar RAT RedLeaves Trochilus RAT
2015-08-01Arbor NetworksASERT Team
Uncovering the Seven Pointed Dagger
9002 RAT EvilGrab PlugX Trochilus RAT APT9
Yara Rules
[TLP:WHITE] win_trochilus_rat_auto (20230808 | Detects win.trochilus_rat.)
rule win_trochilus_rat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.trochilus_rat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.trochilus_rat"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 0fb74636 50 ffd7 0fb7c8 668bd1 662b935e010100 }
            // n = 6, score = 100
            //   0fb74636             | movzx               eax, word ptr [esi + 0x36]
            //   50                   | push                eax
            //   ffd7                 | call                edi
            //   0fb7c8               | movzx               ecx, ax
            //   668bd1               | mov                 dx, cx
            //   662b935e010100       | sub                 dx, word ptr [ebx + 0x1015e]

        $sequence_1 = { 6a32 56 53 e8???????? }
            // n = 4, score = 100
            //   6a32                 | push                0x32
            //   56                   | push                esi
            //   53                   | push                ebx
            //   e8????????           |                     

        $sequence_2 = { 50 ffd3 668b8e52010100 662bc8 6683f903 0f8c9e000000 81863001010018fcffff }
            // n = 7, score = 100
            //   50                   | push                eax
            //   ffd3                 | call                ebx
            //   668b8e52010100       | mov                 cx, word ptr [esi + 0x10152]
            //   662bc8               | sub                 cx, ax
            //   6683f903             | cmp                 cx, 3
            //   0f8c9e000000         | jl                  0xa4
            //   81863001010018fcffff     | add    dword ptr [esi + 0x10130], 0xfffffc18

        $sequence_3 = { 56 8bf1 8d5e04 8bcb e8???????? 83f8ff 7407 }
            // n = 7, score = 100
            //   56                   | push                esi
            //   8bf1                 | mov                 esi, ecx
            //   8d5e04               | lea                 ebx, [esi + 4]
            //   8bcb                 | mov                 ecx, ebx
            //   e8????????           |                     
            //   83f8ff               | cmp                 eax, -1
            //   7407                 | je                  9

        $sequence_4 = { 8d4de4 51 50 ff7538 ff7534 }
            // n = 5, score = 100
            //   8d4de4               | lea                 ecx, [ebp - 0x1c]
            //   51                   | push                ecx
            //   50                   | push                eax
            //   ff7538               | push                dword ptr [ebp + 0x38]
            //   ff7534               | push                dword ptr [ebp + 0x34]

        $sequence_5 = { 5e 5d c20c00 55 8bec 837d08ff 56 }
            // n = 7, score = 100
            //   5e                   | pop                 esi
            //   5d                   | pop                 ebp
            //   c20c00               | ret                 0xc
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   837d08ff             | cmp                 dword ptr [ebp + 8], -1
            //   56                   | push                esi

        $sequence_6 = { 68???????? 50 ff15???????? 85c0 7404 33c0 eb1a }
            // n = 7, score = 100
            //   68????????           |                     
            //   50                   | push                eax
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   7404                 | je                  6
            //   33c0                 | xor                 eax, eax
            //   eb1a                 | jmp                 0x1c

        $sequence_7 = { ff15???????? 33c0 eb81 55 8bec 51 53 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   33c0                 | xor                 eax, eax
            //   eb81                 | jmp                 0xffffff83
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   51                   | push                ecx
            //   53                   | push                ebx

        $sequence_8 = { 33db 391f 7e1d 8b4704 8b4c0304 68a01e0110 e8???????? }
            // n = 7, score = 100
            //   33db                 | xor                 ebx, ebx
            //   391f                 | cmp                 dword ptr [edi], ebx
            //   7e1d                 | jle                 0x1f
            //   8b4704               | mov                 eax, dword ptr [edi + 4]
            //   8b4c0304             | mov                 ecx, dword ptr [ebx + eax + 4]
            //   68a01e0110           | push                0x10011ea0
            //   e8????????           |                     

        $sequence_9 = { b8fac50010 e8???????? 8bf1 837d0800 7505 8b06 ff505c }
            // n = 7, score = 100
            //   b8fac50010           | mov                 eax, 0x1000c5fa
            //   e8????????           |                     
            //   8bf1                 | mov                 esi, ecx
            //   837d0800             | cmp                 dword ptr [ebp + 8], 0
            //   7505                 | jne                 7
            //   8b06                 | mov                 eax, dword ptr [esi]
            //   ff505c               | call                dword ptr [eax + 0x5c]

    condition:
        7 of them and filesize < 630784
}
Download all Yara Rules